java redirect being appended to html

grandmaster · 24-04-2008, 18:32

I run a website and my index and home page keeps having javascript appended to it. (that redirects the user to some russian spyware site ) and I refuse to get my users infected.

I have contacted my webhost who gave me a scripted reply that I was not happy with.

I have changed my passwords twice now and they are 20+ characters with upper and lower case and no word is in the dictionary. ( they said my password may have been bruteforced.. but the previous password was just as strong)

my web host refuse to admit that the server has a problem ( I believe they have a rogue script from another account on there)

But basically this is the 9th time this has happened and I'm getting sick of it .
Does anyone know a way that I can secure my index.html from being modified (the permissions are set to 0644)
I'm getting bored from the lack of response from my webhost and if they dont change their tune soon i'll be walking at taking all my business with me.

Any advice would be nice..

All the best

Ryan

**Paul M** · 24-04-2008, 18:37

I wouldnt wait, move host now. Someone clearly has acesss to the files to exploit them and the host doesnt seem to care.

ikthius · 24-04-2008, 18:57

is the java in your html?

or is there a bit of code in your site somewhere?

but if you keep changing your password, it sounds like there is code stealing your password everytime you change it, try going through your site thoroughly to extract the code/program then try a new password, if it comes back it really is s problem with the host.

ik

grandmaster · 24-04-2008, 19:02

Thanks Paul i'm looking at Voo servers as an alternative..

ik:
The site in question is static html.. index.html.

I wont wont post the script on here for obvious reasons but it starts avaScript>function bban(x){var l=x.length,b=1024,i,j,r,p= etc etc and it should not be in my html.

I have uploaded my clean index I just wonder how long it will last.

grandmaster · 24-04-2008, 21:35

If anyone knows how they are managing to edit these files i would love to know.
pm me please, might help me convince the server company to sort it out.

Ry

Mr_love_monkey · 24-04-2008, 21:45

Not part of the massive web infection that is going on is it?

http://www.theregister.co.uk/2008/04...ss_web_attack/
http://www.theregister.co.uk/2008/01...web_infection/
http://www.channelregister.co.uk/200...ion_continues/

grandmaster · 24-04-2008, 22:57

in fact if there are any php gurus out there that could help me that would be even better,

If I had a script that monitored the size of the index.html and home.html (or any html for that matter ) and somehow alerted me that the size had changed that would help.

Because i'm a programming tard it would take me waaay to long to come up with , write,test a script but i'm sure one of you loverly script writers could know up something in no time.

If you have time to help i would be eternally grateful!

---------- Post added at 21:50 ---------- Previous post was at 21:47 ----------

Could well be.
I would love to get one of these guys in a room with no windows or cameras

Quote:

Originally Posted by Mr_love_monkey

Not part of the massive web infection that is going on is it?

http://www.theregister.co.uk/2008/04...ss_web_attack/
http://www.theregister.co.uk/2008/01...web_infection/
http://www.channelregister.co.uk/200...ion_continues/

---------- Post added at 22:36 ---------- Previous post was at 21:50 ----------

ahaa bisto,after some searching around I have found one that does the job.
If anyone wants it let me know.

ryan

---------- Post added at 22:57 ---------- Previous post was at 22:36 ----------

ok for anyone that cares

I have now got a php script that looks at the file size of the main file.
a cron job will run the script and email me if the size changes.. cool huh.

Again if anyone would like the script let me know..

Ryan

ikthius · 25-04-2008, 07:08

Quote:

Originally Posted by grandmaster

i<snip>

ok for anyone that cares

I have now got a php script that looks at the file size of the main file.
a cron job will run the script and email me if the size changes.. cool huh.

Again if anyone would like the script let me know..

Ryan

hope it works, but seriously, why put up with it happening all the time, make sure there are no nasty scripts in your folders within your space. clean out your folders, make sure its clean, change your password and inform the host company what you have done and when you have done it, and let them know it is totally clean, then if it happens again, you can then tell them they have the problem. and insist they investigate, or you may be looking at another i-web situ.

ik

grandmaster · 25-04-2008, 09:02

Thanks for the reply ik,

I'm going to change servers I think and just use the remaining time on these to test stuff.
Thing is like just before all this happened I bought another 12 month account with them

figures.....

Anyhoo I'm all clean now and I can keep my eye on this and I will be implementing this script across all my sites.

Just gutted that I have to keep throwing money at it, first I-web, now these.
Its not like these sites are even very popular

.

I appreciate you taking the time to reply though :O)

PeteTheMusicGuy · 25-04-2008, 09:10

Deffo move host

punky · 25-04-2008, 10:07

Which host was you with?

webcrawler2050 · 25-04-2008, 13:10

Hmm this isnt the host!!

I guess its something like

<iframe> ashfdashfoah </iframe>

Or script=java injected into your page..

First question.. Does your host use cPanel?
2nd have you asked your host to check the raw access log
3rd: change your password to a random one of numbers and characters
4th: Does your host has FontPage extensions enabled?
5th: Is there a url / ip in the code?
6th: Who is the host
7th: whats your domain

Do not move hosts yet. Theres no point in running as it may happen as your domain could of just be randomly attacked - if you are *desperate* to move host - maybe I / we can help: www.bionic-hosting.co.uk

Mr_love_monkey · 25-04-2008, 13:16

Quote:

Originally Posted by grandmaster

( they said my password may have been bruteforced.. but the previous password was just as strong)

Personally I find the fact they said that quite worrying - don't they do anything to stop brute force attacks?

webcrawler2050 · 25-04-2008, 13:22

Lmao - bruteforce is easy to stop

If run cPanel just turn on Cpanel bruteforce

Anywho its pretty simple - just needs the right knowledge

Mr_love_monkey · 25-04-2008, 13:24

Quote:

Originally Posted by webcrawler2050

Lmao - bruteforce is easy to stop

If run cPanel just turn on Cpanel bruteforce

Anywho its pretty simple - just needs the right knowledge

Exactly - I wouldn't put much faith in them if they can't do that